Threat actors recently distributed phishing emails posing as invitations to a private preview of artificial intelligence technology. The messages impersonate a legitimate video conferencing service to appear authentic, leveraging the high value of exclusive access to new tools as a primary lure. The campaign targets employees who may click links without thorough inspection, aiming to steal login credentials for major productivity platforms. The initial access vector relies on the abuse of trusted business automation and communication tools, allowing the emails to bypass standard security filters. The scope involves organizations where staff are evaluating the integration of new technologies, creating a receptive environment for social engineering attempts that exploit curiosity and professional interest.
The attack chain begins with a link routed through a legitimate URL shortening service to evade detection. Clicking the link presents a standard verification challenge to block automated scanning. Upon completion, a spoofed meeting registration page appears, prompting users to register with work email addresses. Selecting to continue with a major identity provider triggers a second, custom verification challenge designed to detect and block security scanners and virtual private networks. This leads to a credential harvesting page that mimics the login interface of the selected provider. The page for the first provider captures only usernames, while the page for the second provider collects both usernames and passwords. The malicious domains use subdomains and hyphens to obscure their true nature, making them appear similar to legitimate corporate addresses. No redirection to the real login service occurs after submission, and the collected data is exfiltrated directly to the threat actors.[/subscribe_to_unlock_form]
Threat actors recently distributed phishing emails posing as invitations to a private preview of artificial intelligence technology. The messages impersonate a legitimate video conferencing service to appear authentic, leveraging the high value of exclusive access to new tools as a primary lure. The campaign targets employees who may click links without thorough inspection, aiming to steal login credentials for major productivity platforms. The initial access vector relies on the abuse of trusted business automation and communication tools, allowing the emails to bypass standard security filters. The scope involves organizations where staff are evaluating the integration of new technologies, creating a receptive environment for social engineering attempts that exploit curiosity and professional interest.
The attack chain begins with a link routed through a legitimate URL shortening service to evade detection. Clicking the link presents a standard verification challenge to block automated scanning. Upon completion, a spoofed meeting registration page appears, prompting users to register with work email addresses. Selecting to continue with a major identity provider triggers a second, custom verification challenge designed to detect and block security scanners and virtual private networks. This leads to a credential harvesting page that mimics the login interface of the selected provider. The page for the first provider captures only usernames, while the page for the second provider collects both usernames and passwords. The malicious domains use subdomains and hyphens to obscure their true nature, making them appear similar to legitimate corporate addresses. No redirection to the real login service occurs after submission, and the collected data is exfiltrated directly to the threat actors.[emaillocker id="1283"]
The campaign demonstrates a deliberate effort to circumvent automated analysis tools through layered verification challenges and the abuse of reputable services. The use of multiple distinct verification steps complicates the tracking of the full infection chain by defensive systems. The discrepancy between the initial branding and the final login page serves as a key indicator for manual review. Defensive measures should focus on training users to verify brand consistency across the entire interaction and to scrutinize domain names carefully. Organizations should also consider combining automated detection with human-reviewed intelligence to identify subtle anomalies in phishing infrastructure that purely algorithmic systems might miss.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Initial Access | T1566.002 | Phishing | Spearphishing Link |
| Initial Access | T1566.004 | Phishing | Spearphishing Voice |
| Initial Access | T1566.001 | Phishing | Spearphishing Attachment |
| Initial Access | T1566.002 | Phishing | Spearphishing Link |
| Initial Access | T1566.002 | Phishing | Spearphishing Link |
| Initial Access | T1566.002 | Phishing | Spearphishing Link |
| Initial Access | T1566.002 | Phishing | Spearphishing Link |
| Initial Access | T1566.002 | Phishing | Spearphishing Link |
| Defense Evasion | T1027.001 | Obfuscated Files or Information | Environment Variables |
| Credential Access | T1558.004 | Valid Accounts | Cloud Accounts |
| Credential Access | T1056.003 | Input Capture | Web Portal Capture |
| Command and Control | T1071.001 | Application Layer Protocol | Web Protocols |
| Objective | Behavior ID | Behavior |
|---|---|---|
| Execution | B0020 | Send Email |
| Credential Access | E1056 | Input Capture |
| Exfiltration | E1020 | Automated Exfiltration |
| Anti-Behavioral Analysis | B0003 | Dynamic Analysis Evasion |
| Defense Evasion | E1027 | Obfuscated Files or Information |
| Defense Evasion | F0004 | Disable or Evade Security Tools |
The following reports contain further technical details:
[/emaillocker]